Skip to content

National Annex — Romania

Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.

Review Status
Confidence Maintainer reviewed
Checked line by line against the legal text No
Reviewed by a lawyer No
Last reviewed October 2026
Reviewed by Frederik B. Krogsgaard, maintainer
Second reviewer Wanted, see CONTRIBUTING
Next review due April 2027

NIS2 implementation

Field Value
Implementing law OUG nr. 155/2024, the emergency ordinance transposing NIS2, in force 31 December 2024 and approved with amendments by Law No. 124/2025, in force 10 July 2025. Registration with DNSC under Order 1/2025 was due by 22 September 2025.
Competent authority DNSC (Directoratul Național de Securitate Cibernetică)
National CSIRT / reporting DNSC national CSIRT
Official starting point https://www.dnsc.ro

Country notes for your CDC

Registration started a fixed sequence under DNSC Order 2/2025: a risk-level assessment within 60 days of DNSC's registration decision, then a maturity self-assessment within 60 days, then a remediation plan within 30 days.

Standard checklist for all countries

  • GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
  • Entity registration completed with the national authority where required
  • RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
  • Contact established with the national CSIRT before the first incident
  • Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
  • National guidance and frameworks mapped to your control evidence, per the note above

Selector tag

Tick "Romania" in tools/regulatory-profile.html to include this country's references under the ro-nat tag.

Open CDC Framework, licensed CC BY 4.0.